Bcrypt Hash Generator and Checker

Generate and Verify Bcrypt Hashes Online

Updated September 29, 2026 · By Saman

bcrypt is a password hashing algorithm built to be slow on purpose. A general hash such as SHA-256 can be computed billions of times a second, which is exactly what someone guessing passwords from a leaked database wants; bcrypt makes every guess expensive, and its cost factor lets that expense grow as hardware gets faster. It is the default in PHP, Laravel, Ruby on Rails, Spring Security and many other frameworks.

This page opens the bcrypt tab of the Hash Generator. Typical jobs: creating the first admin account directly in a database, writing a test fixture, or finding out why a user cannot log in.

Reading a bcrypt hash

A bcrypt hash is always 60 characters and carries everything needed to check it later. Take $2y$10$N9qo8uLOickgx2ZMRZoMye...:

Choosing a cost

The cost can be set from 4 to 14 here. Each step doubles the work, so cost 12 is four times slower than cost 10. Aim for a hash time of a fraction of a second on your own server; the tool shows its progress while it works, which gives you a feel for the difference. Because the cost is stored in the hash, you can raise it later and rehash each password at its owner's next login.

The 72-byte limit

bcrypt only reads the first 72 bytes of a password. A longer input is not rejected, it is silently cut, so two long passwords that share their first 72 bytes produce the same hash. Characters outside English often take two to four bytes each in UTF-8, so the limit arrives sooner than the character count suggests. The tool counts the bytes as you type and warns once you pass 72.

Checking a hash in code

For random passwords to hash, use the Password Generator. For file checksums rather than passwords, stay with SHA-256.